05c29b1d96008476d28b42a13a4e34e81b628ef4d2bfb203d0075a247bb9431c

General

Target
ekstre.exe
Size 634KB
Sample240206-kcemwsddhr
SHA256 05c29b1d96008476d28b42a13a4e34e81b628ef4d2bfb203d0075a247bb9431c
MD5 08f1f60ad0273992c1ddb62bc12dd7b5
SHA1 8c99f783c4ca334c45e74d9b38d2da88853593b8
SHA512 a742f268d5693d75db9ecb456a3b91be16db31c6552f2a72ff481288646c856dca0b9fc6268f9bc299a1f3ccbecdb6997bfb05de350b8ae40b00f11f2803892c
SSDEEP 12288:Ul1vJDJKWMN1JSqHXe6smw9qG0QY5sM9Hws8CYb7pjPDdtGzU4PW/:Ul1vbKWcrYqGgJwjr7pPhtwUt
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Targets

- Target
  ekstre.exe
- Size 634KB
- SHA256 05c29b1d96008476d28b42a13a4e34e81b628ef4d2bfb203d0075a247bb9431c
- MD5 08f1f60ad0273992c1ddb62bc12dd7b5
- SHA1 8c99f783c4ca334c45e74d9b38d2da88853593b8
- SHA512 a742f268d5693d75db9ecb456a3b91be16db31c6552f2a72ff481288646c856dca0b9fc6268f9bc299a1f3ccbecdb6997bfb05de350b8ae40b00f11f2803892c
- SSDEEP 12288:Ul1vJDJKWMN1JSqHXe6smw9qG0QY5sM9Hws8CYb7pjPDdtGzU4PW/:Ul1vbKWcrYqGgJwjr7pPhtwUt
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
- MD5 b5a1f9dc73e2944a388a61411bdd8c70
- SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
- SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
- SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  Lovliggrelser/Sektionerer/Cupidon/Kobolt.Gla
- Size 41KB
- SHA256 463f10b6c36b2c8e54869ec73781820df1410bbf32814cf5d9d3c655ed46d4d7
- MD5 aa814b7952d3d08a26a5c0b02cee75d4
- SHA1 568a9c283acac3f47846ea0ef9aefe064e65c1b6
- SHA512 8b2983bf27cc7803b2f7628894ee06306d895f797fbffdd757a2bf6b93dc6035de3d32b99884a8ebb9289a15ef08bcf328b84764153f6a8855e812a849f72a62
- SSDEEP 768:DuzPRnjUEtM3R/8ak+1Azi6f/uXSJkTHN7PELrx2Y1ODnQi6ZB2nnCjMiptXH5:eRUEtERDk+WVrJiHpPiraDAsCAwH5
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

persistence
- Modifies Installed Components in the registry
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6